As the old saying goes, security is process, not a product. But since it's very hard, there is always temptation to lean on the latter, not the former.